Title: [166240] trunk
- Revision
- 166240
- Author
- oli...@apple.com
- Date
- 2014-03-25 11:00:30 -0700 (Tue, 25 Mar 2014)
Log Message
ASSERTION FAILED in Parser: dst != localReg
https://bugs.webkit.org/show_bug.cgi?id=130710
Reviewed by Filip Pizlo.
Source/_javascript_Core:
Just make sure we don't try to write to a captured constant,
following the change to track captured variables separately.
* bytecompiler/NodesCodegen.cpp:
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
LayoutTests:
New testcases.
* js/parser-syntax-check-expected.txt:
* js/script-tests/parser-syntax-check.js:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (166239 => 166240)
--- trunk/LayoutTests/ChangeLog 2014-03-25 17:45:52 UTC (rev 166239)
+++ trunk/LayoutTests/ChangeLog 2014-03-25 18:00:30 UTC (rev 166240)
@@ -1,3 +1,15 @@
+2014-03-24 Oliver Hunt <oli...@apple.com>
+
+ ASSERTION FAILED in Parser: dst != localReg
+ https://bugs.webkit.org/show_bug.cgi?id=130710
+
+ Reviewed by Filip Pizlo.
+
+ New testcases.
+
+ * js/parser-syntax-check-expected.txt:
+ * js/script-tests/parser-syntax-check.js:
+
2014-03-24 Brent Fulgham <bfulg...@apple.com>
Prevent 'removetrack' events from firing when all inband text tracks are removed.
Modified: trunk/LayoutTests/js/parser-syntax-check-expected.txt (166239 => 166240)
--- trunk/LayoutTests/js/parser-syntax-check-expected.txt 2014-03-25 17:45:52 UTC (rev 166239)
+++ trunk/LayoutTests/js/parser-syntax-check-expected.txt 2014-03-25 18:00:30 UTC (rev 166240)
@@ -350,6 +350,30 @@
PASS Invalid: "function f() { var a = b ? c, b }"
PASS Invalid: "const a = b : c"
PASS Invalid: "function f() { const a = b : c }"
+PASS Valid: "const a = 7; eval(''); a++"
+PASS Valid: "function f() { const a = 7; eval(''); a++ }"
+PASS Valid: "const a = 7; eval(''); a--"
+PASS Valid: "function f() { const a = 7; eval(''); a-- }"
+PASS Valid: "const a = 7; with({}) a++"
+PASS Valid: "function f() { const a = 7; with({}) a++ }"
+PASS Valid: "const a = 7; with({}) a--"
+PASS Valid: "function f() { const a = 7; with({}) a-- }"
+PASS Valid: "const a = 7; eval(''); a+=1"
+PASS Valid: "function f() { const a = 7; eval(''); a+=1 }"
+PASS Valid: "const a = 7; eval(''); a-=1"
+PASS Valid: "function f() { const a = 7; eval(''); a-=1 }"
+PASS Valid: "const a = 7; with({}) a+=1"
+PASS Valid: "function f() { const a = 7; with({}) a+=1 }"
+PASS Valid: "const a = 7; with({}) a-=1"
+PASS Valid: "function f() { const a = 7; with({}) a-=1 }"
+PASS Valid: "const a = 7; eval(''); a=1"
+PASS Valid: "function f() { const a = 7; eval(''); a=1 }"
+PASS Valid: "const a = 7; eval(''); a=1"
+PASS Valid: "function f() { const a = 7; eval(''); a=1 }"
+PASS Valid: "const a = 7; with({}) a=1"
+PASS Valid: "function f() { const a = 7; with({}) a=1 }"
+PASS Valid: "const a = 7; with({}) a=1"
+PASS Valid: "function f() { const a = 7; with({}) a=1 }"
for statement
PASS Valid: "for ( ; ; ) { break }"
PASS Valid: "function f() { for ( ; ; ) { break } }"
Modified: trunk/LayoutTests/js/script-tests/parser-syntax-check.js (166239 => 166240)
--- trunk/LayoutTests/js/script-tests/parser-syntax-check.js 2014-03-25 17:45:52 UTC (rev 166239)
+++ trunk/LayoutTests/js/script-tests/parser-syntax-check.js 2014-03-25 18:00:30 UTC (rev 166240)
@@ -241,7 +241,20 @@
valid ("var a = a in b in c instanceof d");
invalid("var a = b ? c, b");
invalid("const a = b : c");
+valid("const a = 7; eval(''); a++");
+valid("const a = 7; eval(''); a--");
+valid("const a = 7; with({}) a++");
+valid("const a = 7; with({}) a--");
+valid("const a = 7; eval(''); a+=1");
+valid("const a = 7; eval(''); a-=1");
+valid("const a = 7; with({}) a+=1");
+valid("const a = 7; with({}) a-=1");
+valid("const a = 7; eval(''); a=1");
+valid("const a = 7; eval(''); a=1");
+valid("const a = 7; with({}) a=1");
+valid("const a = 7; with({}) a=1");
+
debug ("for statement");
valid ("for ( ; ; ) { break }");
Modified: trunk/Source/_javascript_Core/ChangeLog (166239 => 166240)
--- trunk/Source/_javascript_Core/ChangeLog 2014-03-25 17:45:52 UTC (rev 166239)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-03-25 18:00:30 UTC (rev 166240)
@@ -1,3 +1,17 @@
+2014-03-24 Oliver Hunt <oli...@apple.com>
+
+ ASSERTION FAILED in Parser: dst != localReg
+ https://bugs.webkit.org/show_bug.cgi?id=130710
+
+ Reviewed by Filip Pizlo.
+
+ Just make sure we don't try to write to a captured constant,
+ following the change to track captured variables separately.
+
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::PostfixNode::emitResolve):
+ (JSC::PrefixNode::emitResolve):
+
2014-03-25 Martin Robinson <mrobin...@igalia.com>
[GTK] Remove the autotools build
Modified: trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp (166239 => 166240)
--- trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2014-03-25 17:45:52 UTC (rev 166239)
+++ trunk/Source/_javascript_Core/bytecompiler/NodesCodegen.cpp 2014-03-25 18:00:30 UTC (rev 166240)
@@ -740,8 +740,7 @@
if (local.isReadOnly()) {
generator.emitReadOnlyExceptionIfNeeded();
localReg = generator.emitMove(generator.tempDestination(dst), localReg);
- }
- if (local.isCaptured()) {
+ } else if (local.isCaptured()) {
RefPtr<RegisterID> tempDst = generator.finalDestination(dst);
ASSERT(dst != localReg);
RefPtr<RegisterID> tempDstSrc = generator.newTemporary();
@@ -916,8 +915,7 @@
if (local.isReadOnly()) {
generator.emitReadOnlyExceptionIfNeeded();
localReg = generator.emitMove(generator.tempDestination(dst), localReg);
- }
- if (local.isCaptured()) {
+ } else if (local.isCaptured()) {
RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
generator.emitMove(tempDst.get(), localReg);
emitIncOrDec(generator, tempDst.get(), m_operator);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
